import { Router } from 'express';
import rateLimit from 'express-rate-limit';
import { acceptInvite, getInvite } from '../controllers/invite.controller.js';
import methodNotAllowed from '../middlewares/methodNotAllowed.js';
import validate from '../middlewares/validate.js';
import { env } from '../config/env.js';
import { errorResponse } from '../utils/response.js';
import { acceptInviteSchema } from '../validators/tenantAdmin.validator.js';

// Public: the link in an invite email. Tokens are long and random; accepting
// sets a password, so it gets the same tighter limit as /auth/login.
const router = Router();

const inviteLimiter = rateLimit({
  windowMs: env.AUTH_RATE_LIMIT_WINDOW_MS,
  max: env.AUTH_RATE_LIMIT_MAX,
  standardHeaders: true,
  legacyHeaders: false,
  handler: (_req, res) => void errorResponse(res, 'Too many attempts, please try again later', 429),
});

router.get('/:token', getInvite);
router.all('/:token', methodNotAllowed('GET'));
router.post('/:token/accept', inviteLimiter, validate(acceptInviteSchema), acceptInvite);
router.all('/:token/accept', methodNotAllowed('POST'));

export default router;